These terms govern your use of the OnCloud platform at app.oncloud.om, its APIs and plugins, and this website (the "Service"), provided by OnCloud ("OnCloud", "we", "us"). By creating an account or using the Service you agree to them. If you use the Service for an organisation, you confirm you may accept these terms on its behalf, and "you" includes that organisation ("Customer").

1. The Service

OnCloud is a business workspace that includes modules such as Contacts, Products, Drive, Marketing, Calendar, Messaging and the AI Hub, and plugins that connect outside services (for example WordPress and WooCommerce, Google and Microsoft sign-in, and AI providers). The features available to you depend on your plan and add-ons.

2. Accounts and workspaces

• You must give accurate information and keep your sign-in details secure. You are responsible for activity under your account. Tell us promptly at security@oncloud.om if you suspect unauthorised use.
• Workspace administrators control who joins, which roles they have, and which modules, plugins and AI features are on. The Customer is responsible for its members' use of the Service.
• You must be at least 18 years old, or the age of majority where you live.

3. Acceptable use

You must not use the Service to:

• break the law, or infringe anyone's rights, including privacy and intellectual property;
• send spam or unsolicited messages, or collect personal data without a lawful basis;
• upload malware, or probe, overload or disrupt the Service or its security;
• access another workspace's data, or get around permissions, limits or metering;
• use the AI features to create content that is unlawful, deceptive or harmful, or against the usage policies of the AI provider involved;
• resell or white-label the Service without our written agreement.

4. Your data

• The Customer owns the content its workspace adds to the Service ("Customer Data"). You give us the rights needed to host, process and display it in order to provide the Service, as described in our Privacy Policy.
• You are responsible for having the right to the Customer Data you add, including personal data about your contacts and members.
• You can export your data while your subscription is active and during a grace period after it ends. After that we may delete it.

5. AI features and credits

• AI output can be wrong or incomplete. Review it before relying on it. The assistant proposes changes; a person approves them, and you remain responsible for what you approve and publish.
• OnCloud AI is metered in AI credits. Credits included in a plan or add-on renew each billing cycle and do not carry over. Credits bought as top-ups are valid for the current cycle only. Credits have no cash value and are not refundable, except where the law requires.
• If a workspace uses its own AI provider key, it is bound by that provider's terms and pays that provider directly; OnCloud logs that usage but does not meter it in credits.
• Local AI is offered as a fixed-fee add-on, subject to fair use.

6. Plugins and third-party services

When you connect an outside service through a plugin, your use of that service is governed by its own terms, and you authorise us to exchange data with it as the plugin requires. We are not responsible for outside services, their availability or changes they make that affect a plugin.

7. Plans, fees and payment

• Fees are shown in the Service or in your order, in Omani rials unless stated otherwise, and exclude taxes, which you pay where applicable.
• Subscriptions renew automatically for the same period unless cancelled before renewal. Fees already paid are not refundable, except where these terms or the law say otherwise.
• If payment is late we may limit the Service after notice.
• We may change prices for the next billing period with at least 30 days' notice.

8. Availability and changes

We work to keep the Service available and secure, but it may be interrupted for maintenance or reasons outside our control. We improve the Service over time and may change or retire features; if a change materially reduces a paid feature, we will give reasonable notice. Features marked beta or preview are provided as they are and may change.

9. Intellectual property

OnCloud and its licensors own the Service, its software, design and brand. These terms give you a limited, non-exclusive, non-transferable right to use the Service during your subscription. You may not copy, modify, reverse-engineer or create derivative works of the Service, except as the law allows. If you send us feedback, we may use it without obligation.

10. Suspension and termination

• You may close your workspace or account at any time from the Service.
• We may suspend or end access if you materially breach these terms, if required by law, or to protect the Service or other users. Where reasonable, we will give notice and a chance to fix the problem first.
• Sections that by their nature should survive (including data, fees owed, intellectual property, disclaimers, liability and governing law) survive termination.

11. Disclaimers

Except as stated in these terms, the Service is provided "as is" and "as available". To the extent the law allows, we disclaim all implied warranties, including fitness for a particular purpose and non-infringement.

12. Limitation of liability

To the extent the law allows, neither party is liable for indirect, incidental, special or consequential damages, or for lost profits, revenue or data, and OnCloud's total liability for any claims relating to the Service is limited to the fees you paid us for the Service in the 12 months before the event giving rise to the claim. These limits do not apply to liability that cannot be limited by law.

13. Indemnity

You will defend and indemnify OnCloud against claims by third parties arising from your Customer Data or your breach of these terms or of the law.

14. Governing law

These terms are governed by the laws of the Sultanate of Oman. The courts of Muscat have exclusive jurisdiction, unless the law requires otherwise.

15. General

• We may update these terms. We will post changes here and update the date above, and give notice of material changes. Continuing to use the Service after changes take effect means you accept them.
• If any part of these terms is unenforceable, the rest remains in force. Not enforcing a right is not a waiver of it.
• You may not transfer these terms without our consent; we may transfer them as part of a reorganisation or sale.
• A signed agreement between OnCloud and a Customer takes precedence over these terms where they conflict.

Contact: legal@oncloud.om · OnCloud, Muscat, Sultanate of Oman.

Questions about this document: legal@oncloud.om

1. Who this applies to

This licence is between [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman ("OnCloud", "we", "us") and the organisation that installs or runs our software ("Customer", "you"). Version 0.9 (draft). Effective 17 October 2026.

It covers OnCloud software that runs on devices or infrastructure you control:

• Private Cloud: the OnCloud workspace installed in your own infrastructure under an annual licence.
• WordPress plugin: the OnCloud plugin for WordPress and WooCommerce sites.
• Chrome browser extension: the OnCloud extension for the Chrome browser.

Use of our hosted service at app.oncloud.om and api.oncloud.om is covered by the Terms of Service, not this licence. Where you use the plugin or extension with a hosted workspace, both apply. If an order form conflicts with this licence, the order form wins for that order.

2. Licence grant

While your licence is active and fees are paid, we grant you a non-exclusive, non-transferable licence to install and use the software for your internal business purposes, within the scope set out in section 3. You may let your employees and contractors use it on your behalf. You are responsible for what they do with it.

We own the software and all rights in it. This licence gives you the right to use it. It does not sell or assign the software or any intellectual property to you.

The WordPress plugin and Chrome extension are licensed free of charge unless an order says otherwise. Paid features in them need an active OnCloud plan.

3. Scope, licence keys and environments

For Private Cloud, your order form sets:

• Seats: the number of people who may have active accounts.
• Environments: how many installs you may run, for example one production and one staging environment.
• Licence key: the key that activates the software for your scope and term.
• Term: normally one year, renewing as the order form states.

Keep your licence key confidential. Do not share it outside your organisation or use it for more seats or environments than you have paid for. If you need more, ask us and we will issue an updated order form and key. If you think a key has been exposed, tell us at support@oncloud.om and we will replace it.

A backup or disaster-recovery copy that is not in active use does not count as an extra environment.

4. Restrictions

Unless the law allows it despite this restriction, or we agree in writing, you must not:

• copy the software beyond what your licensed environments and normal backups need;
• sell, rent, lease, sublicense or host the software for third parties;
• reverse engineer, decompile or disassemble it, or try to extract its source code;
• remove, bypass or tamper with licence keys, seat counts or other licence controls;
• remove copyright, trademark or licence notices;
• modify the software, except for configuration and extension points we document;
• use it to build a competing product;
• use it in breach of the Acceptable Use Policy or applicable law.

5. Updates and support

During an active term you are entitled to updates and security fixes we release for your licensed edition, and to support as set out in your order form. Support hours and response targets follow the Service Level Agreement unless your order form sets different levels.

You decide when to install updates on a Private Cloud install. We support the current release and [the previous release]. If you stay on an older release, we may ask you to update before we can fix a problem.

The WordPress plugin and Chrome extension update through their stores. You can turn automatic updates off in WordPress or Chrome, but older versions may stop working with the hosted service.

6. Your data and our access

Data you put into the software is yours. On a Private Cloud install it stays on your infrastructure. We do not receive a copy.

• No standing access. We have no access to a Private Cloud install unless you grant it, for example to help with a support case. You decide how access is given, for how long, and when it ends.
• When you grant access, we use it only for the purpose you gave, and we process any personal data we see under the Data Processing Agreement.
• No dependency on us to run. Core code and assets have no third-party CDN dependency. A Private Cloud install can run without internet access to OnCloud. Licence checks work [offline / with periodic online validation — to be confirmed].
• Plugins you enable, such as sign-in providers or a bring-your-own AI key, send data to those providers on your instruction. Their terms apply to that data.

The WordPress plugin and Chrome extension send data to your OnCloud workspace only when you connect them to it. What they send is described in the Privacy Policy.

You are responsible for securing, backing up and operating your own infrastructure, and for meeting the data protection laws that apply to you, including Oman's Personal Data Protection Law (Royal Decree 6/2022).

7. Open-source components

The software includes open-source components. Each is licensed under its own terms, which we list in [a notice file shipped with the software / a page at a URL to be confirmed]. Where an open-source licence gives you rights this licence would otherwise restrict, the open-source licence applies to that component. Nothing in this licence limits those rights.

8. Verification

We may ask you, no more than once a year, to confirm in writing that your use is within your licensed seats and environments. If there are reasonable grounds to think it is not, we may ask for a light review, with at least [30] days' written notice, during normal business hours, and limited to licence usage. We will not look at your business data.

If the review shows use beyond your licence, you pay the fees for the extra use at the rates in your order form. If the excess is more than [10]%, you also pay the reasonable cost of the review.

9. Term and termination

A Private Cloud licence runs for the term in the order form and renews as it states. The plugin and extension licences run until you uninstall them or we end them.

Either party may end the licence by written notice if the other materially breaches it and does not fix the breach within [30] days of being told. We may also end it at once if you do not pay undisputed fees within [30] days of a reminder.

When the licence ends:

• you must stop using the software and remove it, except copies the law requires you to keep;
• your data stays on your infrastructure, and it remains yours;
• for [30] days after the end, you may keep a read-only installation running to export your data in the standard formats the software supports;
• any access you granted us ends, and we delete any copies of your data we held for support.

Fees paid for a term are not refunded on termination, except as set out in Refunds and cancellation or your order form.

10. Export control

You must not use, export or re-export the software in breach of export control or sanctions laws that apply to you or to us, including those of the Sultanate of Oman. You confirm that you are not a party named on a sanctions list that prohibits us from dealing with you.

11. Warranty

For [90] days after delivery of a Private Cloud release, we warrant that it will perform materially as described in our documentation. If it does not, and you tell us within that period, we will fix it or replace it. If we cannot, either party may end the licence for that release and we will refund the fees you paid for the unused part of the term. This is your only remedy under this warranty.

The warranty does not cover problems caused by changes you made, by your infrastructure, by third-party software, or by use outside our documentation. The free plugin and extension are provided as they are.

Except as stated here and to the extent the law allows, we give no other warranties, express or implied, including fitness for a particular purpose. AI output produced through the software can be wrong; see AI use.

12. Liability

To the extent the law allows:

• neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or data, arising from this licence;
• each party's total liability under this licence in any 12 months is limited to the fees you paid for the licence in those 12 months, or [US$ amount] for free software.

These limits do not apply to your breach of section 4, to either party's fraud, or to liability the law does not allow to be limited.

13. Governing law and contact

This licence is governed by the laws of the Sultanate of Oman. The courts of Muscat have jurisdiction over any dispute.

We may update this licence. For Private Cloud, changes apply from your next renewal unless you agree earlier. Questions go to legal@oncloud.om; licence keys and support to support@oncloud.om.

Questions about this document: legal@oncloud.om

1. Scope

This Service Level Agreement ("SLA") is part of the Terms of Service between [OnCloud legal entity] ("OnCloud", "we", "us") and the Customer ("you"). Version 0.9 (draft). Effective 17 October 2026.

It applies to paid Business plans (Business Lite and Business Grow) on our Cloud hosting. It does not apply to Personal plans (Personal Free or Personal Plus). For Sovereign and Private Cloud, service levels are set in the order form; where an order form is silent, the support hours and response targets in section 6 apply.

2. Uptime commitment

We commit to 99.5% monthly uptime. Across an average month that allows about 3 hours 39 minutes of downtime.

3. How uptime is defined and measured

The service is up when both of these are true:

• app.oncloud.om is reachable and serves the sign-in page; and
• api.oncloud.om is reachable and accepts sign-in requests.

The service is down when either is not true for all Customers in the region, as measured by our external monitoring checks from at least [two] locations every [one] minute. A minute counts as down when checks from more than one location fail in that minute.

Monthly uptime % = (total minutes in the calendar month − minutes down, excluding section 4) ÷ (total minutes in the month − excluded minutes) × 100.

We publish current status and past incidents at [status page URL]. Our monitoring records are the reference for measuring uptime. If your records differ, send them with your claim and we will review both.

4. Exclusions

Downtime caused by the following does not count against uptime:

• Scheduled maintenance announced at least 48 hours ahead, carried out in the window Friday 00:00–04:00 Muscat time (GMT+4);
• Emergency security fixes that cannot wait for the maintenance window. We will keep them as short as we can and post them on the status page;
• Force majeure: events outside our reasonable control, as defined in the Terms;
• Customer-caused issues: your network, devices, configuration, misuse, or breach of the Acceptable Use Policy;
• Suspension under the Terms, for example for unpaid fees;
• Third-party services and plugins: services we do not run, such as your email provider, a connected WordPress site, Google or Microsoft sign-in, or an AI provider reached with your own key;
• Beta and preview features, marked as such in the product;
• Partial degradation where sign-in works but a single module or feature is slow or unavailable. We still treat these as incidents and report them on the status page.

5. Service credits

If monthly uptime falls below the commitment, you are entitled to a credit as a percentage of the fee you paid for that month for the affected workspace:

Worked example

A workspace on Business Grow pays a monthly fee equal to US$179.90. In a 30-day month (43,200 minutes) the service is down for 520 minutes outside the exclusions. Uptime is (43,200 − 520) ÷ 43,200 × 100 = 98.80%. That is below 99.0% but not below 95.0%, so the credit is 25%: US$179.90 × 25% = US$44.98, applied to the next invoice.

How to claim

• Email support@oncloud.om within 30 days after the end of the affected month.
• Include your workspace name, the dates and times of the downtime, and any records you have.
• We confirm or decline the claim within [15] business days and explain our decision.

Rules

• Credits are applied to future invoices. They have no cash value and are not paid out, except on termination where the law requires.
• Credits in any month are capped at 50% of that month's fee.
• Credits are calculated on the plan fee and extra-person fees, not on AI credits, top-ups or one-off charges.
• For annual plans, the monthly fee is the annual fee divided by 12.
• Service credits are your sole and exclusive remedy for failure to meet the uptime commitment.
• You are not entitled to credits while any undisputed invoice is overdue.

6. Support

Support hours are Sunday to Thursday, 08:00–17:00 Muscat time (GMT+4), excluding public holidays in the Sultanate of Oman. A business hour is an hour within those times. Contact support@oncloud.om or use the help option in the workspace.

You set the severity when you report an issue. We may change it if it does not match the definitions below, and we will tell you why.

These are first-response targets, not resolution times. For Critical issues we keep working on the problem and send updates at least every [4] business hours until it is resolved or downgraded. Security reports go to security@oncloud.om; see Disclosure.

Missing a support target does not give rise to service credits, unless your order form says otherwise.

7. Sovereign and Private Cloud

For Sovereign hosting, uptime, maintenance windows, support hours, response times and credits are set in the order form.

For Private Cloud, you run the infrastructure, so we do not commit to uptime. Support levels for the software are set in the order form and the software licence.

8. Changes

We may update this SLA. We will not reduce the uptime commitment or credit levels during your current paid term. Changes apply from your next renewal, and we will give at least [30] days' notice. Questions go to legal@oncloud.om.

Questions about this document: legal@oncloud.om

1. Parties and scope

This Data Processing Agreement ("DPA") is between [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman ("OnCloud", "we", "us") and the Customer named in the order form or account ("Customer", "you"). Version 0.9 (draft). Effective date: 17 October 2026.

This DPA forms part of the Terms of Service or other agreement under which OnCloud provides the service (the "Agreement"). It applies whenever OnCloud processes personal data contained in the Customer's workspace ("Customer Personal Data").

Laws that may apply include the Oman Personal Data Protection Law (Royal Decree 6/2022, the "Oman PDPL"), the Saudi Personal Data Protection Law (the "Saudi PDPL") and, for Customers in the United Arab Emirates, the federal, DIFC or ADGM regime that applies. Together these are "Data Protection Laws".

2. Roles

• For Customer Personal Data, the Customer is the controller and OnCloud is the processor.
• For account, billing and service-operation data that OnCloud needs to run its own business, OnCloud is a controller. Our Privacy Policy covers that data.
• The Customer is responsible for having a lawful basis for the personal data it puts into OnCloud, and for giving any notices to data subjects.

On Private Cloud, the Customer runs the software in its own infrastructure. OnCloud processes Customer Personal Data only if the Customer grants access for support, and then only for that support.

3. Processing on documented instructions

We process Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and configuration of the service are those instructions. Further instructions must be in writing and consistent with the Agreement.

If the law requires us to process data in another way, we will tell the Customer first, unless the law forbids it. If we believe an instruction breaks Data Protection Laws, we will tell the Customer promptly and may suspend that processing until it is clarified.

We do not use Customer Personal Data to train AI models, and we do not sell it.

4. Confidentiality of personnel

Everyone at OnCloud who can access Customer Personal Data is bound by a written duty of confidentiality. Access is limited to people who need it to provide, support or secure the service. Access ends when it is no longer needed.

5. Security measures

We apply the technical and organisational measures in Annex 2. We may change them over time, but we will not reduce the overall level of protection they give. Our Data Storage Policy describes encryption, backups and retention in more detail.

6. Sub-processors

• The Customer gives general authorisation for OnCloud to use sub-processors. The current list is at Sub-processors.
• Each sub-processor is bound by written terms that protect Customer Personal Data at least as well as this DPA.
• We give at least 30 days' notice before adding or replacing a sub-processor. Notice is given by updating the list and by email to anyone subscribed at legal@oncloud.om and to workspace admins.
• The Customer may object on reasonable data protection grounds within that period. We will then discuss the objection in good faith. If we cannot resolve it, the Customer may end the affected part of the service and receive a pro-rata refund of prepaid fees for it.
• We remain responsible for our sub-processors' performance under this DPA.

Plugins the Customer connects itself, such as WordPress, Google or Microsoft sign-in, or its own AI key, are not OnCloud sub-processors. The Customer's agreement with that provider governs them.

7. International transfers

On the Cloud option, Customer Personal Data is stored in Singapore and some sub-processors operate in other countries. This is a transfer outside Oman, and outside Saudi Arabia for Saudi Customers.

For these transfers, OnCloud will:

• disclose each sub-processor's location in the Sub-processors list;
• put written data protection terms in place with each sub-processor;
• apply the measures in Annex 2, including encryption in transit and at rest;
• meet the cross-border transfer conditions of the Oman PDPL and its executive regulations as they apply to a processor; and
• for Customers subject to the Saudi PDPL, support the Customer in meeting its transfer requirements, including by providing information the Customer needs for a transfer assessment.

Customers who must keep data in Oman or in their own infrastructure may choose Sovereign or Private Cloud. [Lawyer to confirm transfer mechanisms required under the Oman PDPL executive regulations and the Saudi PDPL transfer regulations.]

8. Assistance

Data subject requests

The service lets the Customer find, export, correct and delete personal data. If we receive a request directly from a data subject about Customer Personal Data, we will pass it to the Customer and not answer it ourselves, unless the Customer asks us to. Where the Customer cannot handle a request through the service, we will help within a reasonable time.

Impact assessments and consultation

We will give reasonable help with data protection impact assessments and with any consultation with a regulator, using the information available to us.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify the Customer without undue delay and in any case within [72] hours of becoming aware. We will send notice to the workspace admin email and to any security contact the Customer has given us.

The notice will include, as far as known at the time: what happened, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed. We will send further details as we learn them. We will take reasonable steps to contain the breach and limit its effects.

Notifying a breach is not an admission of fault. Report suspected security issues to security@oncloud.om.

10. Deletion or return at the end

When the Agreement ends, the Customer may export its data during the [30]-day grace period, as described in the Data Storage Policy. After the grace period, we delete Customer Personal Data. Copies in backups are deleted when those backups expire, within [7] days. We may keep data only where the law requires, and then only for that purpose. On request, we will confirm deletion in writing.

11. Audits

• On request, we will provide documentation of our security measures and complete one reasonable security questionnaire per year.
• For Private Cloud, and for Sovereign by agreement, an on-site audit may be arranged on terms agreed in advance.
• Audits take place no more than once per year, with at least 30 days' written notice, during business hours, and must not disrupt the service or expose other customers' data. A regulator's request, or a breach, may justify an additional audit.
• Each party bears its own costs, unless the order form says otherwise. Audit findings are confidential.

12. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Agreement.

13. Order of precedence and term

If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails. If it conflicts with Data Protection Laws, the law prevails. This DPA lasts as long as we process Customer Personal Data. It is governed by the laws of the Sultanate of Oman, and the courts of Muscat have jurisdiction.

Questions: legal@oncloud.om or privacy@oncloud.om.

Annex 1. Processing details

Annex 2. Technical and organisational measures

• Encryption in transit: TLS on all connections to the app and API.
• Encryption at rest: provider disk encryption for the database, object storage and backups.
• Secrets: connection secrets and AI keys encrypted at application level with AES-256.
• Passwords: stored only as one-way hashes.
• Sign-in: optional two-factor authentication for every person.
• Permissions: exact permissions per action. What a person cannot use is hidden, not just disabled.
• Separation: each workspace is separated from every other workspace. Files attached to records belong to the workspace, not to an individual.
• Audit trail: actions in the workspace are recorded.
• AI controls: the assistant reads only what the signed-in person may see; it proposes changes and a person confirms; changes can be undone; conversations are private unless an admin turns on "view all conversations"; workspace content is not used to train models.
• Backups: daily database backups kept [7] days.
• Logs: kept [90] days.
• Personnel: confidentiality duties; access limited to need.
• Sub-processors: written data protection terms; locations disclosed.
• Incident response: breach notification as set out in section 9; reports to security@oncloud.om. See also our Vulnerability Disclosure policy.

Questions about this document: legal@oncloud.om

1. Scope

This policy is part of the Terms of Service between [OnCloud legal entity] ("OnCloud", "we", "us") and the Customer ("you"). It covers Personal and Business subscriptions on our Cloud hosting, paid monthly or annually. Version 0.9 (draft). Effective 17 October 2026.

Fees are charged in Omani rials unless an order says otherwise. Nothing in this policy limits rights you have under consumer protection or other law that cannot be excluded.

2. Cancelling a subscription

• A workspace owner or billing admin can cancel at any time from the billing settings in the workspace, or by writing to support@oncloud.om.
• Cancellation takes effect at the end of the current paid period, monthly or annual. We do not charge you again after that.
• Your workspace stays fully available until the end of the paid period.
• You can reverse a cancellation at any time before the period ends.

3. Your data after cancellation

When the paid period ends:

• A paid Business workspace moves to [read-only / closed status — to be confirmed]. You have a [30]-day grace period to export your data.
• After the grace period, the workspace and its data are deleted, as described in Data storage and retention. Database backups that contain it are overwritten within the following [7] days.
• Billing records are kept as tax law requires.

We recommend you export what you need before your paid period ends.

4. Refunds

First annual payment

If you cancel within [14] days of your first annual payment, we refund the unused part of the year, counted in days from the date you cancel. For example, if you paid for 365 days and cancel on day 10, we refund 355/365 of the annual fee. This applies once per Customer, to the first annual payment only.

AI credits

OnCloud AI credits are pooled per workspace, renew each billing cycle, do not carry over, and have no cash value. Top-ups are valid for the current cycle only. Unused credits and top-ups are not refunded, except where the law requires. If AI credits were charged because of a fault on our side, we restore them.

Suspension and termination for breach

If we suspend or end a workspace because of a breach of the Terms of Service or the Acceptable Use Policy, fees already paid are not refunded.

Service credits

Credits for missing the uptime commitment are handled under the Service Level Agreement, not this policy.

5. Changing plans

• Upgrades take effect at once. We charge the difference for the rest of the current period, pro rata.
• Downgrades take effect at the start of the next billing cycle. You keep the current plan until then. We do not refund the difference for the current period.
• Before a downgrade takes effect, bring your workspace within the lower plan's limits, such as the number of people and storage. If you do not, we will contact you before applying any restriction.
• Removing extra people takes effect from the next billing cycle.

6. Private Cloud, Sovereign and founding clients

• Private Cloud: cancellation, refunds and what happens at the end of the licence are set in your order form and the software licence.
• Sovereign: cancellation and refunds are set in your order form.
• Founding clients: if you signed a founding client agreement, its terms apply where they differ from this policy.

7. Billing errors

If we charged you the wrong amount, charged you twice, or charged you after a cancellation took effect, we correct it in full. Tell us within [60] days of the charge so we can check it quickly. We will still correct errors you find later, as far as our records allow.

8. How refunds are paid

• Refunds go to the original payment method, through [payment processor].
• We issue approved refunds within [14] business days. Your bank or card issuer may take longer to show them.
• Refunds are in the currency you paid. We are not responsible for exchange-rate differences or fees charged by your bank.
• If the original payment method is no longer available, we will agree another method with you.

9. How to request a refund

Email support@oncloud.om from an address linked to the workspace owner or billing admin. Include:

• the workspace name;
• the invoice number and date;
• what you are asking for and why.

We reply within [5] business days. If you disagree with our decision, write to legal@oncloud.om and we will review it.

This policy is governed by the laws of the Sultanate of Oman. We may update it. Changes do not affect payments made before the change.

Questions about this document: legal@oncloud.om

This policy explains how OnCloud ("OnCloud", "we", "us") collects, uses and protects personal data when you use the OnCloud platform at app.oncloud.om, its APIs, its plugins (such as the OnCloud WordPress plugin) and this website (together, the "Service").

1. Our role and yours

• Workspace data. A business or organisation that opens an OnCloud workspace ("Customer") decides what data goes into it: contacts, products, files, messages, calendar items and the like. For that data the Customer is the controller and OnCloud processes it on the Customer's instructions. If you are a contact or member of a Customer's workspace, please direct requests about that data to the Customer first.
• Account and platform data. For your OnCloud account, billing, security logs and this website, OnCloud is the controller.

2. What we collect

• Account data: name, email address, password (stored only as a one-way hash), language and theme choices, two-factor settings, and the workspaces and roles you belong to.
• Sign-in with Google or Microsoft: if you choose it, we receive your name, email address and an account identifier from that provider. We do not receive your password, and we do not read your mailbox, files or calendar through sign-in.
• Workspace content: whatever you and your team add to the Service.
• Connected services: when a workspace connects a plugin (for example a WordPress site or an AI provider key), we store the connection settings and secrets in encrypted form, and exchange the data the plugin needs (for example products, stock and site settings).
• Billing data: plan, add-ons, AI credit purchases, invoices and payment status. Card details are handled by our payment processor; we do not store full card numbers.
• Usage and security data: IP address, device and browser type, sign-in times, actions recorded in the audit trail, and error logs.
• Communications: messages you send us and support requests.

3. How we use it

• to provide, secure and support the Service, including sign-in, permissions and audit trails;
• to run the features a workspace turns on, such as syncing a store, sending notifications or answering AI requests;
• to bill for plans, add-ons and AI credits;
• to detect, prevent and investigate abuse, fraud and security incidents;
• to send service messages (for example invitations, verification codes and important changes). We send marketing messages only where you have agreed, and you can opt out at any time;
• to comply with the law.

We do not sell personal data, and we do not use workspace content to train AI models.

4. AI features

• When a member uses an AI feature, the request and the workspace content needed to answer it are sent to the AI provider the workspace uses. Depending on the workspace's choice this is OnCloud AI (through providers such as Anthropic and Google), the workspace's own provider key ("bring your own key"), or a local model run by OnCloud for that workspace.
• We use providers under commercial terms that do not allow them to train their models on this data.
• The assistant can only read what the member using it is allowed to see, and it proposes changes for a person to approve; it does not act on its own.
• We keep AI conversations and usage records in the workspace so members can see them and so credits can be measured.

5. Who we share it with

• Service providers that help us run the Service, under contracts that limit their use of the data: cloud hosting and databases, email delivery, payment processing, AI providers (for AI features) and error monitoring.
• Services a workspace connects, such as its WordPress store or its Google or Microsoft account, only as the workspace configures.
• Within a workspace, according to the roles and permissions its administrators set.
• Legal reasons: when required by law or a valid order from a competent authority, or to protect the rights of users and OnCloud.
• Business transfers: if OnCloud is reorganised or acquired, under the same protections as this policy.

6. Where data is stored

The Service is hosted on cloud infrastructure, currently in Singapore. Using the Service may therefore involve transferring personal data outside the Sultanate of Oman. We apply the protections required for those transfers as required by applicable law, including Oman's Personal Data Protection Law (Royal Decree 6/2022). Customers with specific residency needs can contact us.

7. How long we keep it

• Workspace content is kept while the workspace is active. Deleted items stay in the workspace's trash for a limited period before permanent deletion. After a workspace is closed, its data is deleted after a grace period, unless the law requires us to keep it.
• Account data is kept while your account exists, and security and billing records for as long as the law requires.

8. Security

We use encryption in transit, encrypted storage for secrets, hashed passwords, optional two-factor authentication, role-based permissions, separation between workspaces, and audit trails. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

9. Your rights

Subject to applicable law, you may ask to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent you have given. Many of these you can do yourself in your account settings. For workspace data, contact the workspace's administrator; we will help them respond. To make a request to us, email privacy@oncloud.om. You may also complain to the competent data protection authority in Oman.

10. Cookies and local storage

We use only what the Service needs to work: keeping you signed in, remembering your language and theme, and protecting against forgery. We do not use advertising cookies. This website does not use tracking cookies.

11. Children

The Service is for businesses and is not directed at children under 18. We do not knowingly collect their personal data.

12. Changes and contact

We will post changes to this policy on this page and update the date above. For significant changes we will also notify workspace administrators.

Contact: privacy@oncloud.om · OnCloud, Muscat, Sultanate of Oman.

Questions about this document: legal@oncloud.om

1. About this policy

This policy explains where OnCloud stores workspace data, how it is protected, how long it is kept and how it is deleted. It applies to the OnCloud workspace at app.oncloud.om, the API at api.oncloud.om, the OnCloud WordPress plugin and the OnCloud Chrome extension.

OnCloud is operated by [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Effective date: 17 October 2026.

This policy sits alongside our Privacy Policy, Data Processing Agreement and Sub-processors list.

2. Where data lives

Where your data lives depends on the hosting option in your order.

Cloud is currently hosted in Singapore. This means workspace data on the Cloud option is stored and processed outside the Sultanate of Oman. Section 3 explains how we handle that under the Oman Personal Data Protection Law.

On Private Cloud, OnCloud has no access to the installation unless the Customer grants it for support. Core code and assets have no third-party CDN dependency, so a Private Cloud installation can run without internet access to OnCloud.

3. Cross-border transfer from Oman

The Oman Personal Data Protection Law (Royal Decree 6/2022) has been enforceable since 5 February 2026. It sets conditions for transferring personal data outside Oman. For the Cloud option we:

• tell Customers before they sign up that Cloud data is stored in Singapore;
• use providers under written terms that require them to protect the data and process it only to provide their service;
• encrypt data in transit and at rest, as described in section 5;
• keep a current list of providers and their locations in Sub-processors;
• follow the transfer requirements in the law and any executive regulations or guidance from the competent authority, as they apply to us; and
• offer Sovereign and Private Cloud for Customers who must keep data in Oman or in their own infrastructure.

As controller, the Customer decides whether the Cloud option suits its obligations, including any obligation to inform or obtain consent from data subjects. Our Data Processing Agreement sets out the transfer terms in more detail. Customers subject to the Saudi PDPL or a UAE regime (federal, DIFC or ADGM) should check those rules too, as they differ.

[Lawyer to confirm the specific transfer conditions and any approval or notification steps required under Royal Decree 6/2022 and its executive regulations.]

4. What is stored where

On Sovereign, the same categories are stored on dedicated OnCloud hardware. On Private Cloud, they are stored wherever the Customer installs the software.

5. Encryption

• In transit: all connections to app.oncloud.om and api.oncloud.om use TLS.
• At rest: the database, object storage and backups use the hosting provider's disk encryption.
• Secrets: connection secrets for plugins and AI keys supplied by a workspace are encrypted at application level with AES-256.
• Passwords: stored only as one-way hashes. We cannot read them.

Other security measures, including two-factor authentication and permissions, are described in our Data Processing Agreement, Annex 2.

6. Backups and restore

On Cloud, we take a full database backup every day and keep each one for [7] days. Backups are stored in the same region as the live data and are encrypted at rest.

Backups exist to recover the service after a failure. They are not a way to recover single items a person deleted. For that, use the trash, which keeps deleted items for [30] days.

If you need a restore after an incident, contact support@oncloud.om. We will tell you what can be recovered and from which date. On Sovereign, backup frequency and retention are set in the order form. On Private Cloud, the Customer is responsible for its own backups.

7. Retention schedule

8. Export and deletion

Export

You can export your data at any time during your subscription and during the grace period after closure. Exports use standard formats, such as CSV for records and the original files for uploads. You do not need to ask us. If an export is not available for a module, contact support@oncloud.om and we will provide one.

Deletion

• Deleted items go to trash, then are permanently deleted after [30] days.
• When a workspace is closed, all its data is deleted after the [30]-day grace period.
• Deleted data leaves backups within [7] days of permanent deletion.
• We keep billing records and anything else the law requires us to keep.

To ask for earlier deletion, email privacy@oncloud.om.

9. Changing hosting location

A Customer on Cloud can move to Sovereign or Private Cloud. The steps are:

1. Contact hello@oncloud.om to agree the new option and sign an order form.
2. For Sovereign, we prepare dedicated hardware at the agreed location. For Private Cloud, the Customer prepares its infrastructure and we provide the software under licence.
3. We export the workspace and move it to the new location on an agreed date.
4. The Customer checks the moved data.
5. We delete the Cloud copy, including from backups within [7] days, and confirm in writing.

Fees and timing are set in the order form.

10. Requests for residency

If your organisation must keep data in a particular country, tell us before you sign up. We will tell you plainly whether Cloud meets that need. If it does not, we will offer Sovereign or Private Cloud. Email privacy@oncloud.om.

11. Changes and contact

We will update this policy when where or how we store data changes. Material changes, such as a new hosting region, will be notified to workspace admins in advance. Questions: privacy@oncloud.om. Security issues: security@oncloud.om.

Questions about this document: legal@oncloud.om

1. What this list covers

A sub-processor is a company OnCloud uses to process personal data in Customer workspaces on the Customer's behalf. This list is part of our Data Processing Agreement.

• Cloud: all sub-processors below apply.
• Sovereign: data stays on dedicated OnCloud hardware. AI runs on local models. No sub-processor applies, except any listed in your order form.
• Private Cloud: OnCloud software runs in your own infrastructure. OnCloud uses no sub-processors, unless you enable a plugin that connects to an outside provider.

Where your data lives is explained in our Data Storage Policy.

2. Current sub-processors (Cloud)

AI providers are used under commercial terms that forbid training their models on workspace content. More detail is in our AI Use Policy.

3. Plugins you connect yourself

Some plugins connect your workspace to a provider you choose and hold an account with. Examples:

• WordPress and WooCommerce sites you connect;
• Google sign-in and Microsoft sign-in;
• your own AI provider key ("bring your own key").

These providers are not OnCloud sub-processors. You decide to connect them, and your own agreement with the provider governs what they do with the data. When you use your own AI key, that provider's terms apply, including its terms on training. Connection secrets and keys are encrypted at application level with AES-256.

4. Changes to this list

We give at least 30 days' notice before we add or replace a sub-processor. During that time you may object on reasonable data protection grounds, as set out in the Data Processing Agreement.

Workspace admins receive notice by email. Anyone else can subscribe to change notices by emailing legal@oncloud.om with the subject "Sub-processor notices".

5. Contact

Questions about this list: privacy@oncloud.om.

Operated by [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Last updated: 17 October 2026.

Questions about this document: legal@oncloud.om

1. About this policy

This policy explains how artificial intelligence (AI) features work in OnCloud. It applies to the workspace at app.oncloud.om, the API at api.oncloud.om, and AI features in the OnCloud WordPress plugin and Chrome extension.

It forms part of our Terms of Service and should be read with our Privacy Policy, Data Processing Agreement and Acceptable Use Policy. If this policy conflicts with a signed order form, the order form applies.

Provider: [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Effective 17 October 2026.

2. What the AI features are

• Assistant. A chat assistant in AI Hub and in the workspace sidebar. It answers questions about your workspace, summarises records and proposes actions.
• Drafting. Drafting and rewriting content in English and Arabic, such as emails, product descriptions, posts, event copy and website text.
• Screen filtering. Describing what you want to see in plain words, which the AI turns into filters on the current screen.
• Image generation. Creating images from a description, where your plan and hosting option include it and an admin has enabled it.

AI features are optional. A workspace admin can turn them off for the whole workspace or for specific people.

3. The three ways AI runs

Which provider processes your AI requests depends on how your workspace is set up.

• OnCloud AI. We route requests to Google (Gemini) as the primary provider. On Business tiers we also use Anthropic (Claude). This is an optional add-on measured in AI credits.
• Bring your own key (BYOK). Your workspace connects its own account with an AI provider through Plugins. Requests go to that provider under your contract with them. No OnCloud AI credits are used.
• Local models on Sovereign. On the Sovereign hosting option, AI runs on models installed on dedicated OnCloud hardware. No third-party AI provider is used.

BYOK keys are encrypted at application level (AES-256) and are never shown again after you save them. See Keys and Secrets.

4. What the AI can read

The assistant acts as the signed-in person. It can read only what that person is allowed to see under their permissions. If a person cannot open a record, contact, file or module, the assistant cannot read it for them either.

The assistant does not read other workspaces. Workspaces are kept separate.

We send a provider only what is needed for the request. We do not send your whole workspace.

5. Human approval and undo

• The assistant proposes changes, such as creating a record, editing a field or scheduling a post. A person must confirm each change before it is made.
• Confirmed changes are recorded in the audit trail with the name of the person who confirmed them.
• Changes made through the assistant can be undone.
• The assistant does not send emails, publish content or make payments on its own.

6. No training on your data

We do not use your workspace content, prompts or AI output to train AI models. We use OnCloud AI providers under commercial terms that forbid them from training on that content.

If your workspace uses its own key, your provider's terms decide how they handle your data. Check those terms before you connect a key.

7. Where conversations are stored and who can read them

• AI conversations are stored in your workspace, in the same location as the rest of your workspace data. See Data Storage.
• Each conversation is private to the person who started it.
• A workspace admin can turn on "view all conversations". It is off by default. When it is on, admins can read all AI conversations in the workspace. Turning it on or off is recorded in the audit trail.
• OnCloud staff do not read your conversations, except where you ask us to for support or where the law requires it.
• Providers may keep request data for a limited time for abuse monitoring, as their commercial terms allow. Retention period: [provider retention period].
• Deleted conversations go to trash for [30] days, then are deleted. They are removed from backups when those backups expire after [7] days.

8. AI credits

OnCloud AI is measured in AI credits.

• Credits are pooled per workspace.
• Admins can split the pool between people or teams, and move unused credit between them during the billing cycle.
• When the workspace or a person reaches their limit, OnCloud AI stops until the next cycle or until an admin buys a top-up. Nothing is charged automatically beyond the cap.
• Credits renew each billing cycle and do not carry over. Top-ups are valid for the current cycle only.
• Credits have no cash value and cannot be transferred to another workspace.

Refund terms are in our Refund Policy. BYOK and Sovereign local models do not use OnCloud AI credits.

9. Accuracy and your responsibility

AI output can be wrong, incomplete, out of date or inappropriate for your audience. It can misread Arabic or English context. It can produce text or images that resemble existing works.

• Review AI output before you rely on it, publish it or send it.
• Do not use AI output as legal, financial, medical or tax advice.
• You are responsible for content you publish or send, including AI-assisted content.
• Where the law or a platform requires you to say that content was made with AI, you must do so.

10. Prohibited uses

You must not use the AI features for anything our Acceptable Use Policy prohibits. In particular, you must not use them to:

• make decisions with legal or similarly significant effects on a person without human review;
• create content that impersonates a real person or organisation, or misleads people about who made it;
• generate unlawful, harassing or sexually explicit content, or content involving minors;
• try to bypass permissions, extract other people's data or get around usage limits;
• break the usage policies of the underlying AI provider.

We may suspend AI features for a person or workspace that breaches these rules.

11. How we choose and review providers

Before we use an AI provider for OnCloud AI, we check that:

• their commercial terms forbid training on customer content;
• they offer a data processing agreement and lawful transfer terms;
• their security controls are documented and independently audited [audit standard, for example ISO 27001 or SOC 2];
• their data retention is limited and stated.

We review providers at least [once a year] and when their terms change. We list current providers on our Subprocessors page and give notice before adding a new one, as set out in our Data Processing Agreement.

We process personal data in AI requests in line with the Oman Personal Data Protection Law (Royal Decree 6/2022) and, where they apply to you, the Saudi PDPL and UAE data protection rules (federal, DIFC or ADGM).

12. Changes to this policy

We may update this policy as our AI features or providers change. For material changes we will notify workspace admins by email at least [30] days before they take effect. The version number and effective date at the top show the current version.

Questions about AI in OnCloud: privacy@oncloud.om. Legal notices: legal@oncloud.om.

Questions about this document: legal@oncloud.om

1. About this policy

This policy explains the cookies and browser storage used by the OnCloud website at oncloud.om and the OnCloud workspace at app.oncloud.om. It is operated by [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Effective date: 17 October 2026.

A cookie is a small text file a website stores in your browser. Browser storage ("local storage") is a similar feature that keeps small settings on your device. Read this with our Privacy Policy.

2. The website (oncloud.om)

The website uses only what it needs to load pages and protect itself from abuse.

• We do not use advertising cookies.
• We do not use cookies that track you across other sites.
• Analytics: [none at present / cookieless analytics — to confirm].

Cloudflare provides content delivery and network protection for our domains. It may set a strictly necessary cookie to tell genuine visitors from automated traffic. [Cloudflare cookie name, if any, to confirm.]

3. The app (app.oncloud.om)

The app uses two cookies. Both are strictly necessary. Without them you cannot sign in or submit changes securely.

• A session cookie keeps you signed in as you move between pages.
• A request-forgery protection token checks that a change you submit really came from you, and not from another site.

Your language and theme (light or dark) are kept in your browser's local storage. They never leave your device as a cookie and are not used to track you.

4. What we set

[Final cookie and storage key names to confirm against the production build.]

5. Signing in with Google or Microsoft

If you choose to sign in with Google or Microsoft, you are sent to that provider's sign-in page. The provider sets its own cookies on its own domain during sign-in. OnCloud does not set or read those cookies. Their use is governed by the provider's own policies.

6. The Chrome extension and WordPress plugin

The OnCloud Chrome extension stores its settings in the extension's own storage in your browser. The OnCloud WordPress plugin runs on your WordPress site, and that site's own cookie policy applies to it. [Extension storage details to confirm.]

7. How to control cookies

You can block or delete cookies in your browser settings. If you block the session cookie or the request-forgery token, you will not be able to sign in to the app. Clearing local storage resets your language and theme to their defaults.

Most browsers let you:

• see which cookies are stored and delete them;
• block cookies from particular sites or all sites;
• clear all cookies and storage when you close the browser.

8. Consent

We do not show a cookie banner because we use only strictly necessary cookies and local settings you choose. If we introduce any non-essential cookie, such as analytics that use cookies, we will add a consent banner first and will not set that cookie until you agree.

9. Changes

We will update this policy when the cookies or storage we use change, and update the version and date above. Questions: privacy@oncloud.om.

Questions about this document: legal@oncloud.om

1. Scope

This Acceptable Use Policy is part of the Terms of Service and the software licence. It applies to everyone who uses OnCloud through a Customer's workspace, including the web app at app.oncloud.om, the API at api.oncloud.om, the WordPress plugin, the Chrome extension, and Sovereign and Private Cloud installs. Version 0.9 (draft). Effective 17 October 2026.

The Customer is responsible for the people it lets into its workspace and for what they do there.

2. Unlawful content and activity

Do not use OnCloud to store, create, send or publish content, or carry out activity, that is unlawful where you or the recipients are. This includes content that:

• breaks the laws of the Sultanate of Oman or other laws that apply to you;
• exploits or harms children;
• incites violence or hatred, or harasses or threatens people;
• is defamatory or fraudulent, including phishing and scams;
• processes personal data without a lawful basis, contrary to Oman's Personal Data Protection Law (Royal Decree 6/2022) or other data protection laws that apply to you.

3. Rights of others

Do not upload, share or publish material that infringes someone else's copyright, trademark, privacy or other rights. This covers files in Drive, brand assets in OnCloud Tower, website builder pages, and content made with AI. If you receive a notice that something infringes, deal with it promptly.

4. Email and messaging

Email sent from a workspace, through Messaging, Marketing or the API, must follow these rules:

• Send marketing email only to people who have given consent, or where the law otherwise allows it.
• Every marketing email must include a working unsubscribe link, and you must honour unsubscribes promptly.
• Identify the sender truthfully. Do not forge headers or disguise where a message came from.
• Do not use bought, rented or scraped lists.
• Stay within the sending limits for your plan. Do not split sending across workspaces to get around them.
• Keep bounce and complaint rates low. We may pause sending if they rise above [thresholds to be set].

5. Malware and harmful code

Do not upload, store or distribute viruses, ransomware, spyware or any code meant to damage, disrupt or gain unauthorised access to systems or data. Do not use Drive or the website builder to host files for phishing or for spreading malware.

6. Probing, testing and overloading

• Do not scan, probe or test the vulnerability of OnCloud systems, except under our disclosure policy or with our written permission.
• Do not interfere with or disrupt the service, other Customers or our providers, including through denial-of-service attacks.
• Do not send API requests at a rate meant to overload the service. Respect the rate limits we publish or return.
• Do not use automated tools to scrape the service, except through the API as documented.

7. Permissions, limits and metering

Do not get around, or try to get around:

• permissions set in a workspace, including those that hide actions a person is not allowed to use;
• plan limits, such as the number of people, storage or sending limits;
• licence keys, seat counts or environment limits on Private Cloud;
• metering of AI credits or other usage.

Sharing one account between several people to avoid paying for extra people counts as getting around plan limits.

8. Other workspaces

Do not access, or try to access, a workspace, account or data you are not authorised to use. If you find that you can see data from another workspace, stop, do not copy it, and tell us at security@oncloud.om.

9. AI features

When you use AI Hub, the assistant or any AI-powered tool, including with your own provider key, do not use it to:

• create content meant to deceive, such as fake reviews, false records or misleading claims presented as fact;
• impersonate a real person or organisation without their permission;
• produce content that is harmful, unlawful or harassing, or that helps someone cause serious harm;
• create content that breaks the usage policies of the AI provider that processes it, including Google and Anthropic on Cloud, or your own provider under bring-your-own-key;
• get around the assistant's controls, such as the step where a person confirms a proposed change.

AI output can be wrong. Review it before you rely on it or publish it. See AI use for how the AI features handle data.

10. Compute and storage

• Do not use the service for cryptocurrency mining, or for heavy computing that is not part of normal business use of the workspace.
• Storage is for business files and records. Do not use Drive as general backup for unrelated systems, as a public file host, or to store large media libraries unrelated to your business.
• Items in trash count against your storage quota until they are permanently deleted.
• If usage is far above what is normal for your plan, we will contact you to agree on a fix, such as a higher plan or reduced usage, before we restrict anything.

11. Resale

Do not resell, sublicense, rent or provide OnCloud to third parties as a service, or run workspaces for other organisations for a fee, unless you have a written reseller or partner agreement with us.

12. Enforcement

When we become aware of a possible breach, we look into it and act in proportion to the risk. Our usual steps are:

1. Notice: we tell the workspace owner what we found and what needs to change, and give a reasonable time to fix it.
2. Restriction: if the problem continues, we may limit a feature, such as pausing email sending, removing specific content or lowering API limits.
3. Suspension: if the problem is serious or still not fixed, we may suspend the affected accounts or the workspace.

Where there is an immediate risk to the service, to other Customers or to people, or where the law requires it, we may restrict or suspend without notice first. We will then tell you what we did and why as soon as we can.

Repeated or serious breaches may lead to termination under the Terms of Service. Fees are not refunded for suspension or termination caused by a breach of this policy. We may report unlawful activity to the authorities.

If you think we got it wrong, reply to our notice or write to legal@oncloud.om. We will review the decision.

13. Reporting abuse

To report abuse of OnCloud, such as spam sent from a workspace, a phishing page on the website builder, or infringing content, email legal@oncloud.om. Include links, message headers or screenshots where you can. For security vulnerabilities, use security@oncloud.om.

We may update this policy. We will post changes here and, for material changes, tell workspace owners in advance.

Questions about this document: legal@oncloud.om

1. Our commitment

OnCloud is built so that people can use it with a keyboard, a screen reader, magnification, or in Arabic or English. When a visual effect and accessibility conflict, accessibility wins.

This statement covers the website at oncloud.om and the workspace at app.oncloud.om. It is issued by [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Effective 17 October 2026.

2. Standard we aim for

Our target is the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA, published by the World Wide Web Consortium (W3C).

The same target applies to the OnCloud WordPress plugin settings screens and the Chrome extension, as far as their host platforms allow.

Current status: partially conformant. This means some parts may not yet fully meet the standard. We will update this status after our first full audit, planned for [audit date].

3. What is built in

• Keyboard navigation. Menus, forms, tables, dialogs and record screens can be used without a mouse.
• Visible focus. The item you are on is always clearly outlined.
• Contrast-checked colours. Text and interface colours are checked against WCAG contrast ratios in both light and dark themes.
• Right-to-left Arabic. When Arabic is selected, the whole layout mirrors, not just the text.
• Reduced motion. If your device asks for reduced motion, we turn off non-essential animation.
• Simple mode. Hides advanced fields so screens show only what most people need.
• Per-person language. Each person chooses their own language, whatever the workspace default is.
• Help text toggle. Field-level help can be shown or hidden, so screens can be fuller or quieter.
• Hidden, not disabled. Actions a person cannot use are hidden rather than shown greyed out, so screen readers do not announce controls that do nothing.

4. Known limitations

[To be completed after audit.] We will list each known issue, its impact and our planned fix below.

Content created by customers, such as websites built with OnCloud Tower, uploaded documents and images, is the responsibility of the customer who publishes it. We give you tools to add alternative text and headings, but we cannot check every item you publish.

Third-party content shown inside OnCloud, such as provider sign-in pages or embedded media, is outside our control.

5. How we test

6. Feedback and contact

If something in OnCloud blocks you or is hard to use, tell us. Email hello@oncloud.om with:

• the page or screen, and what you were trying to do;
• what went wrong;
• the device, browser and any assistive technology you use, if you are happy to share it.

We will reply within 5 business days. If we cannot fix the issue quickly, we will tell you when we expect to, and help you complete your task another way in the meantime.

7. Alternative formats

If you need any of our documents, including our Terms of Service and Privacy Policy, in another format, such as large print, plain text or a document that works better with your screen reader, email hello@oncloud.om. We provide them at no cost.

8. Review of this statement

We review this statement at least once a year and after any major change to the website or workspace.

Last reviewed: [date of last review]. Prepared by: [self-assessment / external auditor name].

Questions about this document: legal@oncloud.om

1. About this policy

This policy explains how to report a security vulnerability in OnCloud and what you can expect from us. It is issued by [OnCloud legal entity], commercial registration [CR number], Muscat, Sultanate of Oman. Version 0.9 (draft). Effective 17 October 2026.

If you are an OnCloud customer reporting a problem with your own account, contact support@oncloud.om instead, unless the problem is a security issue.

2. How to report

Email security@oncloud.om. Please include:

• the affected system, URL, plugin or extension version;
• the type of issue, for example cross-site scripting, broken access control or exposed secret;
• step-by-step instructions to reproduce it;
• a proof of concept, screenshots or request and response samples;
• what an attacker could do with it, in your view;
• any accounts or workspaces you created for testing;
• how you would like to be credited, if at all.

Write in English or Arabic. One issue per report helps us track fixes.

Optional encryption. You can encrypt your report with our PGP key: [PGP key URL]. Fingerprint: [PGP key fingerprint].

Do not include other people's personal data in your report. If you came across any, describe it rather than copying it.

3. In scope

Test only against accounts and workspaces you own or have created for testing. Sovereign and Private Cloud installations belong to our customers: do not test them without the customer's written permission.

4. Out of scope

• Denial of service, load testing or anything that degrades the service for others.
• Social engineering of our staff, customers or providers, including phishing.
• Physical attacks on offices, data centres or devices.
• Spam, or sending unsolicited messages through our forms or email features.
• Findings on third-party services we use, such as DigitalOcean, Cloudflare, Resend, Google or Anthropic. Report those to the provider. See Subprocessors.
• Output from automated scanners without a working proof of the issue.

We may also treat as low priority: missing best-practice headers with no shown impact, clickjacking on pages with no sensitive actions, and issues that need an already compromised device.

5. Rules for researchers

• Do not access, download or keep other people's data beyond the minimum needed to show the issue. Stop as soon as you have shown it.
• Do not change or delete any data that is not yours.
• Do not use a vulnerability beyond what is needed to confirm it, for example by moving to other systems.
• Delete any data you obtained once you have reported it, and confirm this to us.
• Give us reasonable time to fix the issue. Do not disclose it publicly before a fix is released or 90 days after your report, whichever comes first, unless we agree another date with you.
• Follow the law of the Sultanate of Oman and of the country you work from.

6. Our commitments

• We acknowledge your report within 3 business days.
• We give you an initial assessment within [10] business days.
• We send status updates at least every [14] days until the issue is resolved.
• We tell you when the fix is released.
• If you ask, we credit you by name or handle in our release notes or a security acknowledgements page. We will not name you without your permission.
• If an issue affects customer data, we handle it under our incident process and notify affected customers and authorities as the law and our Data Processing Agreement require.

7. Good-faith research

If you act in good faith and follow this policy, we will:

• not pursue or support legal action against you for your research;
• treat your research as authorised for the purposes of our Terms of Service and Acceptable Use Policy;
• make clear, if a third party takes action against you for research done in line with this policy, that your research was authorised by us.

We cannot authorise testing of systems we do not own, and this policy does not bind third parties. If you are unsure whether something is allowed, ask us at security@oncloud.om before you test.

8. Rewards

We do not run a paid bug bounty at present. If that changes, we will update this policy.

9. security.txt

We publish our security contact details in a security.txt file at https://oncloud.om/.well-known/security.txt. The file contains these fields:

If a PGP key is published, the file will also include an Encryption field pointing to [PGP key URL].

10. Changes to this policy

We may update this policy. The version number and effective date at the top show the current version. Changes do not apply to reports already received, unless the change is in your favour.

Questions about this document: legal@oncloud.om